CAIS · OAuth Scopes

CAIS OAuth Scopes

OAuth 2.0 probed

CAIS publishes 12 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the CAIS API on a user’s behalf.

Tokens are issued from https://mcp.caisgroup.com/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyAlternative InvestmentsWealth ManagementFinancial ServicesFintechPrivate MarketsAsset ManagementStructured ProductsInvestment PlatformArtificial Intelligence

Scopes: 12 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://mcp.caisgroup.com/authorize

Token URL
https://mcp.caisgroup.com/token

Flows
authorizationCode

Scopes (12)

Scope	Description	Flows
openid	Standard OpenID Connect scope; requests an ID token for the authenticated advisor.
caisiq:courses:list	List CAIS IQ education courses.
caisiq:reporting:read	Read CAIS IQ reporting.
funds:holdings:read	Read fund holdings.
funds:orders:create	Create fund orders. The only write-side transactional scope advertised.
funds:products:admin-read	Read the fund product catalogue with administrator visibility.
funds:products:advisor-read	Read the fund product catalogue with advisor visibility.
iam:firms:read	Read firm records.
iam:teams:read	Read team records.
iam:users:read	Read user records.
ips:contacts:write	Write investor contacts.
ips:profiles:read	Read investor profiles.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-01'
method: probed
source: https://mcp.caisgroup.com/.well-known/oauth-protected-resource
also: https://mcp.caisgroup.com/.well-known/oauth-authorization-server
description: >-
  Twelve OAuth scopes advertised anonymously by the CAIS MCP server's RFC 9728
  protected-resource metadata and repeated verbatim in its RFC 8414 authorization-server
  metadata. CAIS publishes no scopes reference page, so descriptions below are read
  directly from the scope strings' own domain:resource:action grammar and are marked
  as such — nothing has been invented beyond what the scope name states.
schemes:
- name: mcp-oauth
  type: oauth2
  source: well-known/cais-oauth-protected-resource.json
  resource: https://mcp.caisgroup.com/mcp
  bearer_methods_supported: [header]
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp.caisgroup.com/authorize
    tokenUrl: https://mcp.caisgroup.com/token
    revocationUrl: https://mcp.caisgroup.com/revoke
    registrationUrl: https://mcp.caisgroup.com/register
    code_challenge_methods: [S256]
    grant_types: [authorization_code, refresh_token]
scope_grammar: '<domain>:<resource>:<action>'
domains:
- id: caisiq
  label: CAIS IQ — advisor education and reporting
- id: funds
  label: Fund and product catalogue, holdings and orders
- id: iam
  label: Identity and access — firms, teams, users
- id: ips
  label: Investor profile service — profiles and contacts
scopes:
- scope: openid
  description: Standard OpenID Connect scope; requests an ID token for the authenticated advisor.
  domain: null
  action: identity
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: caisiq:courses:list
  description: List CAIS IQ education courses.
  domain: caisiq
  action: list
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: caisiq:reporting:read
  description: Read CAIS IQ reporting.
  domain: caisiq
  action: read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: funds:holdings:read
  description: Read fund holdings.
  domain: funds
  action: read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: funds:orders:create
  description: Create fund orders. The only write-side transactional scope advertised.
  domain: funds
  action: create
  write: true
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: funds:products:admin-read
  description: Read the fund product catalogue with administrator visibility.
  domain: funds
  action: admin-read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: funds:products:advisor-read
  description: Read the fund product catalogue with advisor visibility.
  domain: funds
  action: advisor-read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: iam:firms:read
  description: Read firm records.
  domain: iam
  action: read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: iam:teams:read
  description: Read team records.
  domain: iam
  action: read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: iam:users:read
  description: Read user records.
  domain: iam
  action: read
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: ips:contacts:write
  description: Write investor contacts.
  domain: ips
  action: write
  write: true
  sources: [well-known/cais-oauth-protected-resource.json]
- scope: ips:profiles:read
  description: Read investor profiles.
  domain: ips
  action: read
  sources: [well-known/cais-oauth-protected-resource.json]
summary:
  total: 12
  read_scopes: 9
  write_scopes: 2
  identity_scopes: 1
  note: >-
    The scope surface is read-dominant. Only funds:orders:create and ips:contacts:write
    mutate state, which is a meaningful agent-safety property: an agent granted the
    default read set cannot place an order.
x-evidence:
  fetched: '2026-08-01'
  url: https://mcp.caisgroup.com/.well-known/oauth-protected-resource
  http_status: 200
  content_type: application/json
docs: null
docs_note: CAIS publishes no public OAuth scopes reference page as of this probe.